Amazon Linux 2027 Defaults to Enforcing SELinux in Public Preview
The public preview of Amazon Linux 2027 arrived on September 3 with a 7.1 kernel, SELinux enforcing by default, and AWS Neuron driver support. Test it now if you are planning an AL2023 migration.
September 3, 2026. AWS announces the public preview of Amazon Linux 2027 (AL2027), the next major release of its cloud-native operating system. September 7, 2026. The distribution leads the AWS Weekly Roundup, confirming availability across all commercial Regions. Why it matters: AL2027 will be the default base for your EC2 fleet over the next two years, and two foundational choices — SELinux enforcing by default and a 7.1+ kernel — will change how the applications you run behave.
What changes from AL2023
AL2027 builds on the AL2023 baseline rather than starting over, which lowers the migration effort. The announced changes reduce to five points:
- Linux 7.1+ kernel: the distribution jumps straight to the 7.x series.
- SELinux enforcing by default: mandatory access control is active on first boot, not merely available.
- AWS-LC for cryptography: Amazon’s library replaces OpenSSL on the critical path to accelerate encryption.
- Current toolchains and runtimes: recent compilers, languages, and runtimes for builders.
- Accelerator drivers, including AWS Neuron: native support for Trainium and Inferentia silicon.
The 7.1+ kernel choice is not trivial: it aligns AL2027 with the Linux 7.x series and its ongoing memory-safety and Rust work. The distribution inherits those recent kernel improvements without waiting for a later major update.
AL2027 continues the family’s biennial cadence — AL2023 in 2023, AL2025 in 2025, AL2027 in 2027 — while keeping the promise of a minimal base with no graphical server or superfluous tooling.
That regularity is an operational argument in its own right: it gives teams a predictable roadmap. Each major release receives multi-year support, so a fleet can stay on AL2023 or AL2025 without urgency while knowing exactly when the next generation arrives and what it changes. AL2025, the current stable release, remains the safe production choice; AL2027 is the target to validate ahead of the cutover.
SELinux enforcing: the real change
The most consequential change is not the kernel, but SELinux moving to enforcing by default. Historically, Amazon Linux shipped SELinux present but permissive: violations were logged, never blocked. AL2027 flips that default.
In practice, an application that writes to the wrong place — an agent touching /etc, or a service listening on an undeclared port — is now blocked, not just flagged in audit.log. It is the right security call, but it is also the most likely source of regressions when migrating from AL2023.
Diagnosis is standard:
sudo grep -i denied /var/log/audit/audit.log | tail -20
sudo audit2why -aThe reflex to avoid is a permanent setenforce 0: it turns a security control into a dead variable. If a workload cannot tolerate enforcing, a targeted policy via audit2allow beats a global shutdown.
What breaks in practice
Moving a workload from AL2023 to enforcing surfaces three recurring families of failure. First, undeclared ports: a service listening on a port outside its policy — say a reverse proxy on 8080 instead of 80 — gets its traffic dropped until the port is labeled with semanage port. Second, non-standard paths: an application writing to /srv or /opt instead of /var/lib sees its writes denied until a semanage fcontext rule is added. Third, homegrown services running as root with no dedicated policy: they inherit the unconfined_service_t domain and behave as before, which hides their real surface.
The productive reflex is to treat enforcing as a discovery tool. The AVC (Access Vector Cache) denials in audit.log document what your applications actually do; each denial fixed through policy sharpens your least-privilege model. That is exactly the effect AWS wants: making SELinux policy an asset, not a burden.
AWS-LC and accelerated cryptography
AWS-LC is Amazon’s general-purpose cryptographic library, derived from BoringSSL and FIPS 140-3 validated. By placing it on the default path, AL2027 promises faster TLS and disk encryption on recent instances, especially those leveraging AES-NI instructions and the vector extensions of Graviton processors.
For an operator, the gain shows up on TLS-heavy workloads — reverse proxies, public APIs, S3 transfers — where encryption latency is the largest CPU cost. The switch is transparent as long as your application does not depend on a specific OpenSSL version with home-grown patches.
On Graviton instances the payoff compounds: AWS-LC is tuned for ARM’s cryptographic extensions, so a workload that spends a third of its CPU on TLS handshakes and bulk encryption sees a measurable drop the moment the image moves to AL2027. For anyone running a public-facing API or a CDN-style reverse proxy on EC2, that is a straightforward performance win with no code change.
Neuron and AI/ML workloads
The third pillar of AL2027 is native support for AWS accelerators: the Neuron drivers cover Trainium and Inferentia chips with no manual install. It is a clear signal of AWS’s direction: the operating system becomes the default landing layer for first-party inference and training workloads, alongside NVIDIA-based GPU instances.
For teams running models through Neuron or Trn1/Inf2 instances, AL2027 removes the SDK bootstrap step. For everyone else, the change is neutral.
The deeper signal is where the operating system is heading. By treating accelerator drivers as a first-class component of the base image, AWS is collapsing the distance between the OS and the ML stack — the same direction it signaled with Amazon Linux 2025’s growing support for AI runtimes. Expect the GA release to tighten this integration further, which is one more reason to start testing on the preview rather than waiting.
How to test the preview
The preview ships in two forms:
- AMIs available in the AWS Management Console, across all commercial Regions, in both x86-64 and ARM variants.
- Container base images on the Amazon ECR Public Gallery.
Feedback goes through the AL2027 GitHub repository, and the documentation lists the full set of changes relative to AL2023. The preview precedes general availability: this is the window to validate your images, user data, and security policies before the production cutover.
The validation checklist reduces to four points: build your AMIs from the base images, replay your bootstrap user data to confirm it runs under SELinux enforcing, run your integration tests on the ARM variant if you are on Graviton, and measure the AWS-LC impact on your TLS workloads. Every point that passes today is one less thing to fix on GA day.
Verdict
If you run AI/ML workloads on Trainium or Inferentia, test AL2027 now: native Neuron support saves you the SDK bootstrap, and the preview is enough to validate your inference pipelines.
If you operate an EC2 fleet on AL2023, set up a dedicated sandbox to verify SELinux enforcing compatibility: it is the thing that will break your applications before anything else, and it is fixed with targeted policy, not by disabling it.
If you stay on AL2023 or AL2025, nothing is urgent: both remain supported, but enforcing-by-default is the trajectory to anticipate in your deployment recipes today.